sn-item: Fix error handling to address SIGSEGV (cherry-pick 2212d1c9f to 3.2-maintenance)

[climashscape]

Cherry-picks 2212d1c9f ("sn-item: Fix error handling to address SIGSEGV (#201)", merged to master 2026-05-21) into 3.2-maintenance.

Why

3.2-maintenance picked up the rest of that series but not this commit: a24316cc7
("Address status notifier items by their registered bus name") and d383f461d
("Fix dbus invocation return value") are both present, while sn-item.c there has no
g_cancellable_cancel. The 3.2.3 release package therefore still ships the
use-after-free.

Symptom

On Mint 22 (zena), libxapp1 3.2.3+zena, xapp-sn-watcher crashed twice in 26 hours
with an identical signature:

kernel: xapp-sn-watcher[244426]: segfault at 200ff ip ... error 4 in libgio-2.0.so.0
Stack trace:
  #0  g_dbus_proxy_get_name (libgio-2.0.so.0)
  #1  xapp-sn-watcher + 0x1036f
  ...
  #11 main (xapp-sn-watcher + 0xa010)
cinnamon-session: Application 'xapp-sn-watcher.desktop' killed by signal 11

xapp-sn-watcher + 0x1036f is the g_critical() at sn-item.c:748:

g_critical ("Could not get properties for %s: %s\n",
            g_dbus_proxy_get_name (item->sn_item_proxy),   /* read of freed proxy */
            error->message);

get_all_properties_callback() takes item from user_data without holding a
reference, and sn_item_dispose() does not cancel the in-flight GetAll call — so if
the item is disposed while the request is pending, the error path dereferences the freed
sn_item_proxy.

Impact

The item registry is in-memory only, so each crash empties it. Clients that watch the
watcher's bus name re-register themselves within seconds; clients that do not lose their
tray icon until the app is restarted. Reproduced here with Flathub QQ Music 1.1.8
(Electron 8.2.1 / Chrome 80), which stayed gone after both crashes while WeChat,
Obsidian, ComfyUI and clash-verge all recovered on their own.

Verification

• Cherry-pick applies cleanly to 3.2-maintenance, no conflicts.
• Diff is identical to the upstream commit (13 insertions, 3 deletions, sn-item.c only).
• Built the watcher from this branch (all four sources + generated D-Bus interfaces):
  compiles and links clean against the 3.2.x headers and system libraries.